Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • Excellent .. Many thanks @gusto2. I'll go through this documentation. Commented Dec 22, 2021 at 16:46
  • Question please .. Anyone who has access to the EC2 parent instance, will be able to see the data coming from the client side in plain text, because this is where the TLS connection terminates, correct? Commented Dec 22, 2021 at 16:50
  • @zakzak depends... You said you want to process and encrypt data in the enclave instance. In that case data going to the "client app" are encrypted, anonymized or tokenized. The enclave instance adds security, but as well complexity and price. Define you thread model and be aware of risk. E. g. do you really need the enclave? Where do you store/manage the ssl private key? Is the complexity worth the risk? (maybe yes) and access the plaintext it's not so easy, one needs to be root to tcpdump the traffic. so there are other options to secure an instance Commented Dec 22, 2021 at 18:54
  • Excellent point. What I meant is that I need to get the data from the client and get it encrypted using an encrypted key generated within the Enclave, and then send the encrypted data to the backend. The idea is that nobody (even the admin or the root of the parent instance) should be able to see the data in plain text. I know that this is possible because EverVault is doing that but not sure how this is possible. Thank you again for your help and appreciate your feedback on this. Commented Dec 22, 2021 at 20:25